CVE-2017-15041

Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory and some other work is done to ensure the proper ordering of operations, "go get" can be tricked into reusing this Git checkout for the fetch of code from pkg2. If the Subversion repository's Git checkout has malicious commands in .git/hooks/, they will execute on the system running "go get."

• http://www.securityfocus.com/bid/101196Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:3463Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:0878Third Party Advisory
• https://github.com/golang/go/issues/22125Issue Tracking, Patch, Third Party Advisory
• https://golang.org/cl/68022Issue Tracking, Patch, Vendor Advisory
• https://golang.org/cl/68190Issue Tracking, Patch, Vendor Advisory
• https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJMailing List, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201710-23Third Party Advisory
• http://www.securityfocus.com/bid/101196Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2017:3463Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:0878Third Party Advisory
• https://github.com/golang/go/issues/22125Issue Tracking, Patch, Third Party Advisory
• https://golang.org/cl/68022Issue Tracking, Patch, Vendor Advisory
• https://golang.org/cl/68190Issue Tracking, Patch, Vendor Advisory
• https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJMailing List, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00014.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/03/msg00015.htmlMailing List, Third Party Advisory
• https://security.gentoo.org/glsa/201710-23Third Party Advisory

Published

Oct 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15033ImageMagick version 7.0.7-2 contains a memory leak in ReadYU…
• CVE-2017-15035EmTec PyroBatchFTP before 3.18 allows remote servers to caus…
• CVE-2017-15037In FreeBSD through 11.1, the smb_strdupin function in sys/ne…
• CVE-2017-15038Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.…
• CVE-2017-15039Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc301…
• CVE-2017-1504IBM WebSphere Application Server version 9.0.0.4 could provi…
• CVE-2017-15042An unintended cleartext issue exists in Go before 1.8.4 and …
• CVE-2017-15043A vulnerability in Sierra Wireless AirLink GX400, GX440, ES4…
• CVE-2017-15044The default installation of DocuWare Fulltext Search server …
• CVE-2017-15045LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3…
• CVE-2017-15046LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a st…5.5
• CVE-2017-15047The clusterLoadConfig function in cluster.c in Redis 4.0.2 a…